Dynamic security scans are performed to identify security vulnerabilities of web applications. For example, a dynamic security scan may determine the type and quantity of vulnerabilities, the locations of the vulnerabilities, and steps to reproduce the vulnerabilities. Typically, dynamic security scans are performed as black-box tests that do not have access to the source code. In this case, the dynamic security scans identify the security vulnerabilities by performing actual attacks on the web applications.